Ho to remove JS:Redirector-H7 [Trj]

I got JS:Redirector-H7 [trj] virus on my website. I figured it out that its a messed up script on my index files and javascript files

My site is in Joomla, and this virus is spread all over site. How can i remove this. Is there any automated software for that? Or is their any programme through which i can know which all files are infected?

Thanks in advance

Whats your FULL website name?

Example: hXXp://www.your-website-name-here.com

Well first you don’t mention the site, change the http in the url to hxxp, to avoid accidental exposure.

Ensure that you are using the latest version of Joomla as old version are vulnerable and being exploited.

You will also have to change and passwords, ftp, control panel, etc. Any template files should also be checked as this is a common means of spreading it to new pages, etc. You will have to look for script tags containing obfuscated javascript and remove those tags or upload clean versions after you have taken care of any software updates, etc. You should also speak to your Host.

its
hxxp://www.uwcm.org/shareyourself/

I just checked it… its on all websites on server

Is there any way to remove that?

I had this on my site too. What I did was download the latest copy of my CMS (using CMSMS) and uploaded all the files, overwriting the old ones. I had to do that for my vBulletin forum as well.

That got rid of the virus.

I don’t believe there is an easy to resolve this as the script tags, although the same sort of format, I believe are different so you can’t easily use something like a find and replace. You can’t use wildcards to remove the opening and closing script tags and the contents as you have legit scripts on the pages.

That is why I said you would effectively have to use your off-line clean back-up files to replace the infected ones.

If you haven’t got back-ups, a good time to do some future planning:
Presumably the injected scripts are in the same location after the closing Head tag and before the opening Body tag (see image).

So you might be able to do a find and replace find * (where the * is a wildcard, depends on the software used.) replace with

. So you are putting the original tags back in place with a couple of line breaks between them.